Which versions of libucl are affected by CVE-2025-6499?

CVE-2025-6499 is a low-severity vulnerability in vstakhov libucl (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…

Is there a public PoC exploit available for CVE-2025-6499?

Yes, a public proof-of-concept exploit is available for CVE-2025-6499. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6499?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

libucl CVE-2025-6499

Q: What is the CVSS score of CVE-2025-6499?

CVE-2025-6499 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-28741 LOW

Buffer Overflow (CWE-119)

2025-06-23 cna@vuldb.com

Buffer Overflow Libucl

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local attack, low privileges, no user interaction, only availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.3 (LOW) 1.9 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-28741

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

PoC Detected

Sep 18, 2025 - 13:06 vuln.today

Public exploit code

CVE Published

Jun 23, 2025 - 03:15 cve.org

LOW 1.9

CVE Published

Jun 23, 2025 - 03:15 nvd

LOW 3.3

DescriptionCVE.org

A vulnerability classified as problematic was found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_parse_multiline_string of the file src/ucl_parser.c. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

AnalysisAI

Heap-based buffer overflow in libucl up to 0.9.2 allows local attackers to cause a denial of service via crafted input to the ucl_parse_multiline_string function. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.04%).

Technical ContextAI

libucl is a C library for parsing and emitting UCL (Universal Configuration Language) configuration files. The vulnerability is a heap-based buffer overflow (CWE-119) in the ucl_parse_multiline_string function within src/ucl_parser.c. The CPE indicates all versions up to 0.9.2 are affected. The root cause is improper bounds checking when handling multiline strings, leading to memory corruption.

RemediationAI

Upgrade to libucl version 0.9.3 or later once released. As a workaround, restrict local access to the library or avoid processing untrusted UCL files. Monitor the GitHub issue for patch updates: https://github.com/vstakhov/libucl/issues/319.